CVE-2024-34362: 
NixOS vulnerability analysis and mitigation

Envoy, a cloud-native open source edge and service proxy, contains a use-after-free vulnerability (CVE-2024-34362) in the HttpConnectionManager (HCM) with EnvoyQuicServerStream that can crash the service. The vulnerability was discovered and disclosed in June 2024, affecting multiple versions of Envoy including versions up to 1.27.6, 1.28.4, 1.29.5, and 1.30.2 (GitHub Advisory).

The vulnerability stems from EnvoyQuicServerStream not executing reset callbacks upon receiving a RESET_STREAM frame when no STOP_SENDING is received before or afterwards. The issue occurs when a client sends a request without FIN followed by a RESET_STREAM frame. In this scenario, OnStreamReset() doesn't call runResetCallbacks() because the write side remains open. The stream then hits idle timeout in HCM, triggering a local reply. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

When successfully exploited, this vulnerability can lead to a crash of the Envoy service due to use-after-free condition. The vulnerability primarily affects the availability of the service, with no direct impact on confidentiality or integrity (GitHub Advisory).

An attacker can exploit this vulnerability by sending a request without FIN, then a RESET_STREAM frame, and after receiving the response, closing the connection. The attack requires network access but no authentication or user interaction (GitHub Advisory).

The vulnerability has been patched in multiple versions of Envoy: version 1.30.2, 1.29.5, 1.28.4, and 1.27.6. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).